A virtual asset service provider, or VASP, is a person or business that carries out specified virtual asset activities for or on behalf of others as a business. The term comes from FATF standards and can include exchange, transfer, custody, and certain issuer-related services, subject to local implementation.
Classification depends on activities
Whether a business is a VASP depends on what it actually does, not only its branding or technical architecture. Activities involving exchange between virtual assets and money, exchange between virtual assets, transfers, or safekeeping may fall within the definition. National legislation determines the precise scope and any relevant exclusions.
A software supplier is not necessarily a VASP merely because its product supports virtual asset activity. Equally, describing a service as a platform or technology business does not remove obligations where its functions meet the legal test. Operators should examine control over assets, customer relationships, execution, and transfer arrangements.
What classification means for exchanges
VASP status can bring registration or licensing requirements alongside customer due diligence, monitoring, recordkeeping, and reporting obligations. Travel Rule duties may also apply. The responsible authority, application process, and permitted services vary across jurisdictions, and the FATF term should not be treated as a universal license category.
An exchange should map each proposed service to the rules in the markets it intends to serve. Spot trading, custody, brokerage, and derivatives may require different permissions or fall under separate frameworks. Outsourcing technology or compliance tasks does not necessarily transfer the regulated entity’s responsibility for meeting its obligations.
Why the legal perimeter matters
Understanding the perimeter helps operators decide which entity provides each service, where authorization is needed, and which controls must exist before launch. It also supports clearer contracts and customer disclosures. Businesses should revisit their assessment when adding products, changing custody arrangements, or entering another market, rather than relying indefinitely on the classification used for an earlier operating model.
